CyberRota Analysis
AI-GeneratedLoofah versions prior to 2.25.2 are vulnerable to improper sanitization of SVG elements, allowing crafted SVGs to reference arbitrary same-origin external documents through the href attribute. This can lead to the execution of malicious scripts or the loading of external images, posing a risk of content injection and tracking. Developers and organizations utilizing Loofah for sanitizing user-supplied SVG content should prioritize upgrading to version 2.25.2 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept the plain href attribute. A crafted sanitized SVG can therefore reference an arbitrary same-origin external document; use may render external SVG content containing scripts or other dangerous content, and feImage may load external images for tracking. Applications that sanitize user-supplied SVG with Loofah's default allowlist are affected. This issue is fixed in version 2.25.2.